Time Warner Cable DNS Under DDoS Attack

quote:

---

Of course switching to OpenDNS temporarily (or permanently, if you like their service) should help users.

---

C:\utils\ns_bench>ns_bench 68.94.156.1 68.94.157.1 208.67.222.222 208.67.220.220
 4.2.2.1 4.2.2.3
Nameserver              Response Time (ms)
                        min/avg/max/stdev/retries
 
68.94.156.1             12.17/12.62/13.38/0.44/0
68.94.157.1             12.32/14.32/21.39/3.54/0
208.67.222.222          14.05/14.69/16.05/0.71/0
208.67.220.220          13.89/14.08/14.27/0.15/0
4.2.2.1                 14.60/15.20/15.59/0.43/0
4.2.2.3                 13.89/14.51/15.15/0.53/0
 

C:\utils\ns_bench>ns_bench 68.94.156.1 68.94.157.1 208.67.222.222 208.67.220.220
 4.2.2.1 4.2.2.2
Nameserver              Response Time (ms)
                        min/avg/max/stdev/retries
 
68.94.156.1             11.94/14.03/18.49/2.37/0
68.94.157.1             11.90/12.49/13.23/0.47/0
208.67.222.222          13.94/14.34/15.17/0.45/0
208.67.220.220          13.47/13.93/14.53/0.35/0
4.2.2.1                 13.69/14.24/15.02/0.46/0
4.2.2.2                 failed
 

C:\utils\ns_bench>ns_bench 68.94.156.1 68.94.157.1 4.2.2.2 4.2.2.3
Nameserver              Response Time (ms)
                        min/avg/max/stdev/retries
 
68.94.156.1             11.91/12.32/12.71/0.27/0
68.94.157.1             12.49/12.76/13.18/0.24/0
4.2.2.2                 failed
4.2.2.3                 13.26/13.89/14.22/0.34/0
 

OpenDNS redirection.

OpenDNS error.

C:\utils\ns_bench>nslookup www.xyzzyiz2krazy4me.org
Server:  resolver1.opendns.com
Address:  208.67.222.222
 
Non-authoritative answer:
Name:    www.xyzzyiz2krazy4me.org.aosake.net
Address:  208.67.216.132
 

C:\utils\ns_bench>nslookup www.xyzzyiz2krazy4me.org
Server:  resolver1.opendns.com
Address:  208.67.222.222
 
*** resolver1.opendns.com can't find www.xyzzyiz2krazy4me.org: Non-existent doma
in
 

quote:

---

Our DNS servers are currently running slowly/failing to do lookups. This is causing some of our sites to resolve slowly or not at all. Our admin team is working on the issue right now. More updates to come.

Update: We are experiencing a DNS flood to our primary DNS servers which has stopped for now but the admin team is continuing to investigate so that we can attempt to avoid and further issues related to this incident. We apologize for the inconvenience!

Update: We have found the source of the problem. It looks like there is a windows trojan going around that attempted to make contact with a domain that is pointing to our nameservers, but isn’t actually being hosted by us (was likely an old customer that removed it from hosting, but didn’t change the nameservers to point away from us). This caused the flood of traffic to come in and overwhelm our DNS servers. You can find more information about this trojan here:

»www.sophos.com/security/analyses···taa.html

Unfortunately, DNS attacks are nearly impossible to stop if they’re well crafted. In this case, all of the traffic is perfectly legitimate and there’s nothing special about the packets that any protection system could really block. We are in contact with verisign (the registrar of that domain) now to try and stop this domain from pointing to our nameservers and are doing everything we can on our end to resolve this issue.

Update: This issue should now be resolved, as we’ve been able to filter out traffic for the offending domain, and send it to the bit bucket! We haven’t seen a surge in DNS traffic since 02:20pm PST, so things are in the clear!

Update: Unfortunately, we are still being attacked sporadically even after blocking this virus and are still investigating the issue. We are not the only ones being affected by this. Time Warner cable is also suffering from this as well:

»arstechnica.com/security/news/20···vice.ars

We’re doing all that we can to resolve this issue, but since it’s out of our control there’s only so much we can do.

---

## Extended DNS setup
all-servers
domain-needed
filterwin2k
bogus-priv
stop-dns-rebind

# Kill DNS redirection by TWC for unknown domains
bogus-nxdomain=208.67.219.132

# Local DNS GUI option enabled = Use ISP DNS servers received through DHCP in addition to  DNS servers below.

## Additional DNS servers
# Level3 AnyCast DNS servers
server=209.244.0.3
server=4.2.2.2

# Speakeasy DNS servers
server=64.81.45.2
server=64.81.79.2

# OpenDNS AnyCast DNS servers
server=208.67.222.222
server=208.67.220.220

Nameserver          Response Time (ms)
                    min/avg/max/stdev/retries
 
66.75.160.63        64.00/65.60/68.00/1.36/0
66.75.160.64        64.00/64.80/66.00/0.75/0
208.67.222.222      29.00/31.80/38.00/3.19/0
208.67.220.220      23.00/24.00/25.00/0.63/0
4.2.2.1             14.00/15.80/18.00/1.47/0
4.2.2.2             15.00/16.40/21.00/2.33/0
4.2.2.3             14.00/15.00/18.00/1.55/0
4.2.2.4             13.00/14.60/16.00/1.20/0
4.2.2.5             12.00/14.20/16.00/1.47/0
4.2.2.6             13.00/15.60/18.00/1.62/0